1418931 - QuotaManager in sanitize.js is not origin-aware

Status: RESOLVED FIXED

(Core :: Storage: Quota Manager, defect, P2)

Description

[Anna]

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0
Build ID: 20171107091003

Steps to reproduce:

1. set privacy.firstparty.isolate=true
2. go to https://static.raymondcamden.com/demos/2014/feb/7/index.html#/home and add a note
3. try to clear Website Offline Data under Clear Recent History


Actual results:

the IndexedDB is not cleared + error in the console:
Error sanitizing offlineApps Exception { name: "NS_ERROR_ILLEGAL_VALUE", message: "Component returned failure code: 0x…", result: 2147942487, filename: "chrome://browser/content/sanitize.js", lineNumber: 336, columnNumber: 0, data: null, stack: "clear/</</<@chrome://browser/conten…", location: XPCWrappedNative_NoHelper }  sanitize.js:152
Error: Error sanitizing  sanitize.js:184:13


Expected results:

IDB should have been cleared.

note: it works when using "Clear All Data" in the new Site Data UI in the Options.

sanitize.js is not fully origin-aware, see [this](https://dxr.mozilla.org/mozilla-central/source/browser/base/content/sanitize.js#320) vs [_removeQuotaUsage](https://dxr.mozilla.org/mozilla-central/source/browser/components/preferences/SiteDataManager.jsm#177).

tested in latest ESR and nightly 59

note2: I know that firstparty-isolation is not enabled by default but since containers also use origins they could also have this problem.

Comment 1

[Hsin-Yi Tsai (she/her)[:hsinyi]]

Hi Shawn, please take a look!

Comment 2

[Hsin-Yi Tsai (she/her)[:hsinyi]]

I didn't manage to reproduce this on latest nightly (59.0a1 2017-12-12) and release (57.02) on win10.
After I cleared "Website offline data" under Clear Recent History and then refresh about:preferences page, the data usage under new Site Data UI became 0.

Comment 3

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

Yes. I will do it today.

Comment 4

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

Keep ni to me.

Comment 5

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

I can't reproduce the bug, based on description STR.

Comment 6

[Andrew Sutherland [:asuth] (he/him)]

At a high level, I believe this is being fixed by bug 1252998 with the introduction of the StorageActivityService to allow time-range-based clearing to allow us to clear offlineApps without worrying about wiping out all offline storage.

Comment 7

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

> sanitize.js is not fully origin-aware, see
> [this](https://dxr.mozilla.org/mozilla-central/source/browser/base/content/
> sanitize.js#320) vs
> [_removeQuotaUsage](https://dxr.mozilla.org/mozilla-central/source/browser/
> components/preferences/SiteDataManager.jsm#177).
> 
> tested in latest ESR and nightly 59
nsIQuotaManagerService::GetUsage, this method returns an array with information about all origins that have stored data.
So santize.js is aware of origin information.

It looks like GetUsage returns NS_ERROR_ILLEGAL_VALUE. But I can't reproduce it locally.

Comment 8

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

I also tried with both Container and FirstParty isolation, it seems to work fine.

Comment 9

[Thorin [:thorin]]

Steps to reproduce: https://github.com/ghacksuserjs/ghacks-user.js/issues/8#issuecomment-351557678

FF57.0.1 = reproducible: Note this is clearing "Offline Website Data" only via Clear-All-History (time range everything).

- Will test with container only, and combined Origin Attributes of FPI+container
- Will test FPI and time range NOT everything
- will test FF58

Comment 10

[Thorin [:thorin]]

(In reply to Simon Mainey from comment #9)
> Steps to reproduce:
> https://github.com/ghacksuserjs/ghacks-user.js/issues/8#issuecomment-
> 351557678
> 
> - Will test with container only, and combined Origin Attributes of
> FPI+container
> - Will test FPI and time range NOT everything


FYI: Link on github updated with results. Time range did not seem to make any difference (which it has in the past re sanitizing). Containers on their own also had a reproducible result. With the contextID issue confirmed, I did not bother testing for a combined Origin Attribute.

Will now test on 58

Comment 11

[Thorin [:thorin]]

^^ FF58.0b: Tested FPI and containers individually, and can no longer reproduce - same tests as above. No console errors and IDB entries are removed

Comment 12

[Thorin [:thorin]]

^^ thats FF58.0b11

Comment 13

[Anna]

I can still reproduce it in ESR but not in Nightly. Unless you want to fix it in ESR you can close this

Comment 14

[Marion Daly [:mdaly]]

we're approaching a new ESR, we can close this.